EDPB - Binding Decision 1/2026

Summary

The European Data Protection Board (EDPB) issued a binding decision regarding a complaint lodged by noyb against Vlaamse Radio- en Televisieomroeporganisatie (VRT) concerning its cookie banner. The Austrian DPA initially proposed dismissing the complaint, alleging abuse of rights by the data subject and noyb due to the standardized and automated nature of the complaint. However, the EDPB found no evidence of abuse, emphasizing that the data subject had validly mandated noyb and lodged a complaint concerning their own rights. The EDPB instructed the Austrian DPA to assess the complaint on its merits.

Full text

Help EDPB - Binding Decision 1/2026: Difference between revisions From GDPRhub Jump to:navigation, search VisualWikitext Revision as of 14:33, 21 July 2026 view sourceBms (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators211 edits Tag: submission [1.0] Latest revision as of 14:44, 21 July 2026 view source Bms (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators211 editsTag: Visual edit (One intermediate revision by the same user not shown)Line 88: Line 88: === Facts ====== Facts === On 10 August 2021, a data subject represented by noyb lodged a complaint with the Austrian DPA against Vlaamse Radio- en Televisieomroeporganisatie (VRT), the controller. The complaint concerned the controller’s cookie banner and alleged infringements of Articles 5(1)(a), 6(1)(a), 12(1), 12(2) and 13(1)(c) GDPR, as well as Article 5(3) ePrivacy Directive. It formed part of a wider project involving similar cookie banner complaints submitted by noyb across the EEA.On 10 August 2021, a data subject represented by noyb lodged a complaint with the Austrian DPA against Vlaamse Radio- en Televisieomroeporganisatie (VRT), the controller. The complaint concerned the controller’s cookie banner and alleged infringements of [[Article 5 GDPR|Articles 5(1)(a)]], [[Article 6 GDPR|6(1)(a)]], [[Article 12 GDPR|12(1)]], [[Article 12 GDPR|12(2)]] and [[Article 13 GDPR|13(1)(c) GDPR]], as well as [https://eur-lex.europa.eu/eli/dir/2002/58/oj/eng Article 5(3) ePrivacy Directive]. It formed part of a wider project involving similar cookie banner complaints submitted by noyb across the EEA. The Austrian DPA transferred the complaint to the Belgian DPA, which acted as the lead supervisory authority. In its draft decision, the DPA proposed dismissing the complaint without examining its merits. It considered that the data subject and noyb had abused the rights provided under Articles 77 and 80(1) GDPR.The Austrian DPA transferred the complaint to the Belgian DPA, which acted as the lead supervisory authority. In its draft decision, the DPA proposed dismissing the complaint without examining its merits. It considered that the data subject and noyb had abused the rights provided under [[Article 77 GDPR|Articles 77]] and [[Article 80 GDPR|80(1) GDPR]]. The DPA relied on factors including the standardised and partly automated preparation of the complaints, noyb’s role in selecting the targeted controllers, the relationship between the data subject and noyb, and the broader strategic objectives pursued by the organisation. It considered that both the objective and subjective elements required to establish an abuse of rights were present.The DPA relied on factors including the standardised and partly automated preparation of the complaints, noyb’s role in selecting the targeted controllers, the relationship between the data subject and noyb, and the broader strategic objectives pursued by the organisation. It considered that both the objective and subjective elements required to establish an abuse of rights were present. Line 101: Line 101: The EDPB found that the Austrian DPA’s objection met the requirements of [[Article 4 GDPR#24|Article 4(24) GDPR]]. The objection was directly connected to the draft decision, proposed a different outcome and sufficiently demonstrated the risks that the dismissal would create for data subjects’ rights and the consistent application of the GDPR.The EDPB found that the Austrian DPA’s objection met the requirements of [[Article 4 GDPR#24|Article 4(24) GDPR]]. The objection was directly connected to the draft decision, proposed a different outcome and sufficiently demonstrated the risks that the dismissal would create for data subjects’ rights and the consistent application of the GDPR. On the merits, the EDPB recalled that the prohibition of abuse of rights must be interpreted strictly, particularly where its application may restrict the fundamental right to data protection and the rights provided by Articles 77 and 80(1) GDPR. The supervisory authority alleging abuse bears the burden of establishing both its objective and subjective elements on the basis of sufficient evidence.On the merits, the EDPB recalled that the prohibition of abuse of rights must be interpreted strictly, particularly where its application may restrict the fundamental right to data protection and the rights provided by [[Article 77 GDPR|Articles 77]] and [[Article 80 GDPR|80(1) GDPR]]. The supervisory authority alleging abuse bears the burden of establishing both its objective and subjective elements on the basis of sufficient evidence. Regarding the objective element, the EDPB acknowledged that noyb had organised a project involving predefined selection criteria, standardised complaints and automated tools. However, the data subject had validly mandated noyb under [[Article 80 GDPR#1|Article 80(1) GDPR]] and had lodged a complaint concerning an alleged infringement of their own data protection rights. Consequently, the objectives of Articles 77 and 80(1) GDPR had been fulfilled rather than circumvented.Regarding the objective element, the EDPB acknowledged that noyb had organised a project involving predefined selection criteria, standardised complaints and automated tools. However, the data subject had validly mandated noyb under [[Article 80 GDPR#1|Article 80(1) GDPR]] and had lodged a complaint concerning an alleged infringement of their own data protection rights. Consequently, the objectives of [[Article 77 GDPR|Articles 77]] and [[Article 80 GDPR|80(1) GDPR]] had been fulfilled rather than circumvented. Regarding the subjective element, the EDPB found no evidence that the complaint had been submitted to obtain an undue advantage unrelated to the purposes of the GDPR. The objectives pursued by noyb could not be separated from those of the data subject merely because the organisation had played a leading role in preparing the complaint. Nor was there evidence that the data subject or noyb had sought compensation or another financial benefit.Regarding the subjective element, the EDPB found no evidence that the complaint had been submitted to obtain an undue advantage unrelated to the purposes of the GDPR. The objectives pursued by noyb could not be separated from those of the data subject merely because the organisation had played a leading role in preparing the complaint. Nor was there evidence that the data subject or noyb had sought compensation or another financial benefit. The EDPB therefore concluded that the data subject had not abused the right to lodge a complaint under [[Article 77 GDPR|Article 77 GDPR]] or the right to be represented under [[Article 80 GDPR#1|Article 80(1) GDPR]]. It instructed the DPA not to dismiss the complaint on that basis, to assess it on its merits and to submit a new draft decision to the supervisory authorities concerned under [[Article 60 GDPR#3|Article 60(3) GDPR]]. No fine or corrective measure against the controller was imposed, since the alleged cookie banner infringements remained to be examined.The EDPB therefore concluded that the data subject had not abused the right to lodge a complaint under [[Article 77 GDPR]] or the right to be represented under [[Article 80 GDPR#1|Article 80(1) GDPR]]. It instructed the DPA not to dismiss the complaint on that basis, to assess it on its merits and to submit a new draft decision to the supervisory authorities concerned under [[Article 60 GDPR#3|Article 60(3) GDPR]]. == Comment ==== Comment == Latest revision as of 14:44, 21 July 2026 EDPB - Binding Decision 1/2026 Authority: EDPB Jurisdiction: European Union Relevant Law: Article 4(24) GDPR Article 57(1)(f) GDPR Article 57(4) GDPR Article 60(3) GDPR Article 60(4) GDPR Article 65(1)(a) GDPR Article 77 GDPR Article 80(1) GDPR Article 8 CFR Type: Other Outcome: n/a Started: Decided: 28.05.2026 Published: 14.07.2026 Fine: n/a Parties: APD (Belgian DPA) DSB (Austrian DPA) Vlaamse Ra

Entities